web2py remote code execution via hardcoded encryption key in session.connect function

Also known as GHSA-q2rq-qgcf-m22w, PYSEC-2026-570

Published 8 y ago 2018-02-06 · modified 4 mo ago 2026-07-01 · JSON

CVSS

9.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

3.3%

percentile 89%

Public exploits

none known

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.

Exploit prediction (EPSS)

3.34% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	9.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	7.5	`AV:N/AC:L/Au:N/C:P/I:P/A:P`
GitHub	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
OSV	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
pypi	`web2py`	<2.14.2	2.14.2

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

devco.re /blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/ · x_refsource_MISC, x_transferred
github.com /web2py/web2py/blob/R-2.14.1/applications/examples/models/session.py · x_refsource_MISC, x_transferred
usn.ubuntu.com /4030-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
nvd.nist.gov /vuln/detail/CVE-2016-3953 · advisory
github.com /web2py/web2py/issues/1205 · web
github.com /web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40 · web
devco.re /blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · web
github.com /web2py/web2py · package
usn.ubuntu.com /4030-1 · web
pypi.org /project/web2py · package
github.com /advisories/GHSA-q2rq-qgcf-m22w · advisory

Sources

CVE List: CVE-2016-3953
GitHub Advisory: GHSA-q2rq-qgcf-m22w
NVD: CVE-2016-3953
OSV: PYSEC-2026-570

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.